CVE-2015-0919 – Multiple SQL injection vulnerabilities in the administrative backend in S

Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0919

Reference (s):

• http://forum.sefrengo.org/index.php?showtopic=3360
• FULLDISC:20150106 SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0
• URL: http://seclists.org/fulldisclosure/2015/Jan/9
• http://packetstormsecurity.com/files/129824/Sefrengo-CMS-1.6.0-SQL-Injection.html
• http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-04.html